silverstripe/silverstripe-framework — pull request #2601 by chillu (2013-10-24 08:57:22+00:00)
Title: FIX Sanitize SS_HTTPResponse_Exception body (fixes #2597)

Edge case XSS prevention: The body is forced to a text/plain content type, but
proxies modifying the HTTP response or content sniffing user agents might
cause the body to be interpreted as HTML anyway.

Moved text/plain header setting into the SS_HTTPResponse_Exception constructor
in order to ensure its consistently applied.

Note: SS_HTTPResponse_Exception is mainly used through
RequestHandler->httpError()

Thanks to Nathan Brauer for reporting.